fix: handle duplicate email sign-up and null user in protected layout

- Register action now returns success instead of redirecting to /account/setup
  so users without a session (duplicate email with requireEmailVerification)
  see a 'check your email' message instead of crashing
- Protected layout guards against null/undefined locals.user before querying
  Prisma (was passing id: undefined)
- Updated register page to show success banner with verification instructions
- Updated test to match new action response

src/routes/register/+page.svelte

@@ -8,7 +8,17 @@
 
 <Window>
 	<div class="flex flex-col items-start justify-center">
-		{#if form?.error}
+		{#if form?.success}
+			<div
+				class="mb-4 w-full rounded-lg border border-green-200 bg-green-50 p-4 text-green-700"
+			>
+				<p class="font-medium">Account created!</p>
+				<p class="mt-1 text-sm">
+					We've sent a verification email. Check your inbox and click the link to verify your
+					email address, then log in.
+				</p>
+			</div>
+		{:else if form?.error}
 			<div class="mb-4 w-full rounded-lg border border-red-200 bg-red-50 p-3 text-red-700">
 				{form.error}
 			</div>